pcgaming – Valorant anti-cheat starts upon computer boot and runs all the time, even when you don’t play the game
The kernel anticheat driver (vgk.sys) starts when you turn your computer on. To turn it off, you either need to change the name of the driver file so it won’t load on a restart, or you can uninstall the driver from add/remove programs, look for “Riot Vanguard” and remove that (it will be installed back again when you open the game).
side note, why is it that many users are reporting that uninstalling the game does not uninstall the anti-cheat? why are they separate? An uninformed user could uninstall Valorant but be unaware that this anti-cheat is still running on their PC -_-
so ya, the big issue here is it running even when players don’t have the game open, from startup no less. second EDIT – It runs at Ring 0 of the Windows Kernel which means it has even greater rights than windows administrator from the moment you boot, it’s the highest level of access, i.e. complete control of a PC and hardware.
If you’d like to see for yourself, open cmd and type “sc query vgk” <---- yes this is done to find a service, but riot vanguard has a service part and a kernal driver part, this has been confirmed by RiotArkem and literally any user who has looked into this.
For comparison, BattlEye and EasyAntiCheat both load when you’re opening the game, and unload when you’ve closed it. This point is important, cause while other anti-cheat might have similar access level (and people have also complained about those, this is not just complaining about riot) they don’t run 24/7 on ur PC.
This has all been confirmed as intended behavior by RiotArkem over at r/VALORANT, as well as him giving an explanation about riot’s stance on this: https://www.reddit.com/r/VALORANT/comments/fzxdl7/anticheat_starts_upon_computer_boot/fn6yqbe/
Now look, I can understand why they do it and people wanting a better anti-cheat… but this just brings up a whole number of issues from data to vulnerability to security to trust:
you have a piece of software that can’t be turned off, that runs with elevated privileges non-stop on your system. If someone with malicious intent can figure out a way to use it as a rootkit… like come on, riot are not magicians creating perfect software that can’t be cracked or beaten (as apparently some valorant fans think)
let’s say the ant-cheat gets compromised tomorrow, you won’t know that your computer is exposed and it won’t update until you start the game
I also believe it should be made very clear that this is something that the the game does, and at the very least should be something togglable. RiotArkem is already saying you can uninstall the anti-cheat if you want to, so let this be something users can easily toggle.
then comes the trust issue EDIT – yes privacy is a complex issue, and you are already giving up your privacy using things like smartphone, google, amazon and so on… this is still a point to make about riot:
with the amount of backlash blizzard (rightfully) got for the blitzchung incident and how people were all over blizzard for tencent having shares in it, 5% stake… how are there ppl actually just waving off anyone with concerns of having a startup kernel on their system from a company OWNED by tencent? how are there people faulting others for caring about this issue and asking for more than just riot saying “trust us”?